What factors can cause a files properties to show that it has been 'modified' rather than just 'accessed'? Obviously entering and saving the content even without even changing it will cause such an update to be effected, but can other factors can have the same effect? eg does deleting a file cause it to show as having been modified if it is recovered and so on…?
Think of logfiles. Adding lines to them also modifies the "modified" flag. Depending on your filesystem, the M-time can also be set to the deletion time.
Thanks very much! in terms of XML log files specifically, would a deletion of one from the history file tend to cause a file to appear as having been 'modified' to the deletion time as a matter of course, or would it require a setting to be altered specifically for this to be the case?
Not forgetting anti-virus or anti-spyware software removing malicious code or something similar from within a file.
Chris,
Be sure to view documentation specific to the file system of interest. How a file system behaves depends not only on the specifications of the file system itself, but also the vendor's implementation of that file system. Microsoft has a couple of pages on their site regarding differences between FAT32 and NTFS.
Also, nothing beats your own experimentation. For example, on NTFS, open a file and then save it. Note the MAC times. Wait a bit, open the file and modify it, then save it, again noting the MAC times. Then perform a clean shutdown of the system and reboot, again noting the MAC times of the file (on NTFS, last modification times are not immediately written to disk, according to MS documentation).
Harlan